My Data 
Protection Rights 


My data protection rights factsheet: 
Why are data protection rights important? 


We all have a number of rights when it comes to our personal data. Adults and 
children have exactly the same rights, and these rights apply both in the real 
world and the online world. 


It's important that you know what your data protection rights are because this 
will help you have control over your personal data and will also help you spot if 
companies are not treating your data fairly. 


Who is in charge of my data protection rights? 

You can “exercise” your rights, in other words “use” your rights yourself, at any 
age but only if it's clear that you understand your rights and that letting you use 
them yourself is the best thing for you and doesn't cause you any harm. 


Young children will likely need their parents or guardians to look after their data 
for them and the older you get, the more likely you are to use your rights yourself. 
But just because you're in charge of your personal data, doesn't mean you can't 
ask your parents for help. In fact, there might be some situations where it’s best to 
ask your parent or guardian to help you use your data protection rights. 


For example, your parents might have set up a savings account in your name so 
they can put away some money for you for when you're older. As the account 
holder, you can of course ask the bank to give you your data. However, some of 
this information might be very technical and difficult to understand. 


In this case, it's a good idea to ask your parent or guardian or an adult you trust 
to help you make this request, to make sure that you fully understand everything 
and can talk to someone about it. 


What data protection rights do I have? 
You can find more information about all your data protection rights on the DPC's website: 
https://www.dataprotection.ie/en/dpc-guidance/childrens-data-protection-rights 


My data protection rights factsheet: 
Knowing what's happening to your data 


You have the right to know what's happening to your data and why. This means 
that you have the right to know when your personal data is being collected 

by someone else. This is known as “the right to be informed”. The right to be 
informed is one of the most important data protection rights because you can't 
control your data if you don't know who has it or what they're doing with it. 


There are certain things that an organisation must tell you whenever they collect 
your data. For example, they have to tell you who they are, what exactly they are 
doing with your data and why, how long they're going to keep your data, and 
they must also tell you what your data protection rights are and how you can get 
in touch with them if you want to exercise your data protection rights. 


The law says that organisations have to make sure that this information is really 
clear and easy for children to understand. It also has to be easy for children to find 
this information. It's also a good idea to get your parents to help you read them in 
case you have any questions. 


Where can I find this information? 

Organisations normally put all of this information in a document that's called a 
privacy policy which you can usually find on their website. Social media platforms 
and apps also use things like pop-up notices to remind you of this information at 
different times, so for example some information about what's happening to your 
data might pop up on your screen if you make changes to your account settings or 
if you're just about to post a photo or video. 


Why is it important that I read this stuff? 

It can be very tempting to just swipe past these notices because you want to get 
on with setting up your profile, chatting with your friends or posting your photos. 
And it doesn't help that privacy policies are often really long and not that fun to 
read. But it's a good idea for you to get into the habit of taking a look at them 
because they have a lot of important information that you need to know. 


What data protection rights do I have? 
You can find more information about all your data protection rights on the DPC's website: 
https://www.dataprotection.ie/en/dpc-guidance/childrens-data-protection-rights 


My data protection rights factsheet: 
Getting a copy of your data 


You have the right to get a copy of any information that an organisation holds 
about you. This is known as the right of access. 


What do I do if | want a copy of the data that social media 
companies have about me? 

Social media apps usually have an "access my data” or “download my data” tool in 
the account settings page which allows you to do this quickly and easily. However, 
you also have the right to ask for a copy of your data directly, for example by 
sending the organisation an email or by calling their helpdesk. The key thing is 
they have to make it EASY for you to ask for your data. 


Are there any limits on what | can get? 

Sometimes there are certain rules that might stop an organisation from giving you 
a full copy of your data. One reason for this is data can often involve more than 
one person. Think for example of group photos or instant messages between you 
and your friends on social media. If you ask for data involving other people, the 
organisation will have to think carefully about what's fair for everyone, and may 
have to withhold some stuff. But they still have to answer you and give you as 
much data as they can! 


Are there any special words I need to use to make my access 
request? 

You don't need to mention any laws or use any special words when asking for your 
data. All that matters is that it’s clear that you're asking for a copy of your data. 


Once you've made your request, the company needs to reply to you within one 
month. If you don't hear anything within one month then you can complain to the 
Data Protection Commission (DPC). 


You also have the right to move your data from one company to another. This is 
known as the right to data portability. You might use this right if you're changing 
email providers and want to copy over all of your contacts. It's important to note 
that there are some rules around when you can use this right, and it mightn't 
always be possible to do it, but you can always ask the organisation or the DPC for 
advice if you're unsure. 


What data protection rights do I have? 
You can find more information about all your data protection rights on the DPC's website: 
https://www.dataprotection.ie/en/dpc-guidance/childrens-data-protection-rights 


My data protection rights factsheet: 
Getting your data deleted 


This is known as the right to erasure. This right can be important when somebody 
under 18 has provided their personal data to an online company like a social 
media platform but then they change their mind later on and now want to get 
the social media platform to delete their account. So children have a special 
protection in this way. 


It's important to remember that just because you have asked a social media 
platform to delete a piece of your data like a photograph that you posted, this 
doesn't mean that the photo will be deleted on the phones of everyone who might 
have saved it or screenshotted it. So make sure to think before you post. 


Does this mean | can make anyone delete all of my data whenever 
I want? 

No, because there will be some situations where you can't use your data 
protection rights. There are lots of examples from daily life where an organisation 
needs to keep your personal data, whether you agree to it or not. For example, 
your school needs to keep certain information about you such as your name, 
where you live and who your parents are. You can't make them delete this 
information because it's necessary for the school to know these things. 


You only have the right to delete your data in certain cases. For example, if you 
told an organisation they could use your data but you've now changed your mind, 
or ifthe organisation collected your personal data without a good reason in the 
first place then you normally have a right to get it deleted if you want. 


Correcting mistakes in your data 

On top of deleting your data, you also have the right to ask organisations to fix 
it or update it if you think there's a mistake in it or there's something missing or 
its out of date. This is called the right to rectification. You might use this right 
ifyou've changed phone numbers and you want your sports club to update this 
information so you don't miss out on any important messages about matches or 
training. 


What data protection rights do I have? 
You can find more information about all your data protection rights on the DPC's website: 
https://www.dataprotection.ie/en/dpc-guidance/childrens-data-protection-rights 


My data protection rights factsheet: 
Saying “no” to other people using your data 


This is known as the right to object. This basically means that you have the right 
to tell an organisation that you don't agree with them using your data and to 
ask them to stop. There are certain times when you can use this right and when 
you can't. For example, if a company is using your personal data to send you 
information by email or post about products they're trying to sell to you, you can 
tell them to stop whenever you want. 


I don't understand. If I don't want an organisation using my data 
then surely they need to stop? 

It's important to understand that not all organisations need your permission 

to use your data. Some organisations have a duty to keep your data, like the 
government. Other organisations might have a really good reason to use your 
data without asking for your permission in some circumstances. An example 
might be the CCTV cameras at your local shopping centre. The shopping centre 
doesn't need to ask visitors for permission to record them through CCTV as the 
cameras are needed to prevent things like crime and keep customers and staff 
safe. When it comes to children, organisations have to take extra care and make 
sure that their reason for using personal data doesn't cause any harm whatsoever 
to children. 


Saying “no” to important decisions being made only by computers 
Decisions made entirely by computers happen so often when we go online that 
we barely notice them. For example, the content that we see when we're scrolling 
through social media feeds or the ads that we see when we open a new webpage 
are the result of decisions by computers that are made based on our personal 
data. 


Why is this important? 

Because data protection law says that any important decisions that are made 
based on your personal data must have real people involved. Examples 

of important decisions could be an application for a loan from a bank, a job 
application or a university application. If you are worried that an organisation has 
made an important decision about you using only computers with no humans 
involved, you have the right to have that decision explained to you, to ask 
questions about the decision and to have a real live person get involved in making 
the decision. If you are still not happy, you can complain to the DPC. 


How do | make a complaint to the DPC? 

The best way to make a complaint to the DPC is to fill out the “raise a concern” 
webform which you'll find on our website. A member of the DPC will then get in 
touch with you about your complaint. You can also call one of our helplines or 
send us your complaint by post if you prefer. You can find more information about 
how to contact us on our website at: https://www.dataprotection.ie/en/contact/ 
how-contact-us 


What data protection rights do I have? 
You can find more information about all your data protection rights on the DPC's website: 
https://www.dataprotection.ie/en/dpc-guidance/childrens-data-protection-rights 


